chromium/third_party/blink/web_tests/external/wpt/navigation-api/navigate-event/replaceState-in-unload-then-remove-iframe.html

<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<iframe id="i" src="/common/blank.html"></iframe>
<script>
async_test(t => {
  window.onload = t.step_func(() => {
    i.contentWindow.onunload = t.step_func(() => {
      i.contentWindow.history.replaceState(null, "", "#");
      i.remove();
      t.step_timeout(t.step_func_done(), 0);
    });
    i.contentWindow.location = "/common/blank.html?1";
  });
}, "reacting to the navigate event doesn't crash when replaceState is called in onunload");
</script>